@cosmicdrift/kumiko-bundled-features 0.319.0 → 0.321.0

package/src/delivery/unsubscribe.ts

@@ -1,9 +1,12 @@
 import {
   type ExtraRouteDefinition,
   ExtraRouteRejection,
+  type SignatureExtraRouteDeps,
+  type SignatureExtraRouteVerifyRequest,
   signatureRoute,
 } from "@cosmicdrift/kumiko-framework/api";
 import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
+import { escapeHtmlAttr } from "@cosmicdrift/kumiko-headless";
 import * as jose from "jose";
 import * as z from "zod";
 import { hashUnsubscribeAddress } from "./address-opt-out";
@@ -55,8 +58,8 @@ export type AddressUnsubscribeTokenPayload = {
 /**
  * `secret` must be a value dedicated to unsubscribe-token signing — do NOT
  * reuse the app's session `JWT_SECRET`. The app mounting `extraRoutes:
- * [createUnsubscribeRoute({ secret })]` signs outgoing links with the same
- * value via `signUnsubscribeToken` / `signAddressUnsubscribeToken`.
+ * [...createUnsubscribeRoutes({ secret })]` signs outgoing links with the
+ * same value via `signUnsubscribeToken` / `signAddressUnsubscribeToken`.
  */
 export type UnsubscribeRouteOptions = {
   readonly secret: string;
@@ -152,110 +155,185 @@ type VerifiedUnsubscribe =
       readonly channel: string;
     };
 
-export function createUnsubscribeRoute(options: UnsubscribeRouteOptions): ExtraRouteDefinition {
-  assertUnsubscribeSecret(options.secret, "createUnsubscribeRoute");
-  const encodedSecret = new TextEncoder().encode(options.secret);
+// RFC 8058 fixed value — both the List-Unsubscribe-Post header and the body a
+// one-click client POSTs.
+export const DELIVERY_UNSUBSCRIBE_ONE_CLICK_HEADER_VALUE = "List-Unsubscribe=One-Click" as const;
 
-  return signatureRoute<VerifiedUnsubscribe>({
-    method: "GET",
-    path: DELIVERY_UNSUBSCRIBE_PATH,
-    entry: "signature",
-    // Every throw here must become the same ExtraRouteRejection(400,
-    // unsubscribe_token_invalid) — anything else falls through to the
-    // framework's generic 401 extra_route_signature_invalid mapping, which
-    // would leak jose's internal error text into the response body.
-    verify: async ({ query }) => {
-      try {
-        const token = query["token"];
-        if (!token) {
-          throw new ExtraRouteRejection(
-            400,
-            UNSUBSCRIBE_TOKEN_INVALID_BODY,
-            "missing unsubscribe token",
-          );
-        }
+const CONFIRMATION_PAGE_HEADERS = {
+  "Cache-Control": "no-store",
+  "Referrer-Policy": "no-referrer",
+} as const;
 
-        const { payload: verifiedPayload } = await jose.jwtVerify(token, encodedSecret, {
-          issuer: "kumiko:unsubscribe",
-        });
+// Every throw here must become the same ExtraRouteRejection(400,
+// unsubscribe_token_invalid) — anything else falls through to the
+// framework's generic 401 extra_route_signature_invalid mapping, which
+// would leak jose's internal error text into the response body.
+async function verifyUnsubscribeToken(
+  token: string | undefined,
+  encodedSecret: Uint8Array,
+): Promise<VerifiedUnsubscribe> {
+  try {
+    if (!token) {
+      throw new ExtraRouteRejection(
+        400,
+        UNSUBSCRIBE_TOKEN_INVALID_BODY,
+        "missing unsubscribe token",
+      );
+    }
 
-        const addressAttempt = addressUnsubscribeJwtPayloadSchema.safeParse(verifiedPayload);
-        if (addressAttempt.success) {
-          const parsed = addressAttempt.data;
-          if (parsed.sub !== parsed.addressHash) {
-            throw new ExtraRouteRejection(
-              400,
-              UNSUBSCRIBE_TOKEN_INVALID_BODY,
-              "address token subject mismatch",
-            );
-          }
-          // @cast-boundary engine-bridge — string post-zod → branded TenantId
-          const tenantId = parsed.tenantId as TenantId;
-          return {
-            kind: "address",
-            tenantId,
-            addressHash: parsed.addressHash,
-            notificationType: parsed.notificationType,
-            channel: parsed.channel,
-          };
-        }
+    const { payload: verifiedPayload } = await jose.jwtVerify(token, encodedSecret, {
+      issuer: "kumiko:unsubscribe",
+    });
+
+    const addressAttempt = addressUnsubscribeJwtPayloadSchema.safeParse(verifiedPayload);
+    if (addressAttempt.success) {
+      const parsed = addressAttempt.data;
+      if (parsed.sub !== parsed.addressHash) {
+        throw new ExtraRouteRejection(
+          400,
+          UNSUBSCRIBE_TOKEN_INVALID_BODY,
+          "address token subject mismatch",
+        );
+      }
+      // @cast-boundary engine-bridge — string post-zod → branded TenantId
+      const tenantId = parsed.tenantId as TenantId;
+      return {
+        kind: "address",
+        tenantId,
+        addressHash: parsed.addressHash,
+        notificationType: parsed.notificationType,
+        channel: parsed.channel,
+      };
+    }
+
+    const userAttempt = unsubscribeJwtPayloadSchema.safeParse(verifiedPayload);
+    if (!userAttempt.success) {
+      throw new ExtraRouteRejection(
+        400,
+        UNSUBSCRIBE_TOKEN_INVALID_BODY,
+        "unsubscribe token payload matched neither schema",
+      );
+    }
+    const parsed = userAttempt.data;
+    // @cast-boundary engine-bridge — string post-zod → branded TenantId
+    const tenantId = parsed.tenantId as TenantId;
+    return {
+      kind: "user",
+      tenantId,
+      userId: parsed.sub,
+      notificationType: parsed.notificationType,
+      channel: parsed.channel,
+    };
+  } catch (err) {
+    if (err instanceof ExtraRouteRejection) throw err;
+    throw new ExtraRouteRejection(
+      400,
+      UNSUBSCRIBE_TOKEN_INVALID_BODY,
+      "unsubscribe token verification failed",
+    );
+  }
+}
 
-        const userAttempt = unsubscribeJwtPayloadSchema.safeParse(verifiedPayload);
-        if (!userAttempt.success) {
-          throw new ExtraRouteRejection(
-            400,
-            UNSUBSCRIBE_TOKEN_INVALID_BODY,
-            "unsubscribe token payload matched neither schema",
-          );
+async function dispatchUnsubscribeWrite(
+  verified: VerifiedUnsubscribe,
+  deps: SignatureExtraRouteDeps,
+): Promise<boolean> {
+  const payload =
+    verified.kind === "address"
+      ? {
+          addressHash: verified.addressHash,
+          notificationType: verified.notificationType,
+          channel: verified.channel,
         }
-        const parsed = userAttempt.data;
-        // @cast-boundary engine-bridge — string post-zod → branded TenantId
-        const tenantId = parsed.tenantId as TenantId;
-        return {
-          kind: "user",
-          tenantId,
-          userId: parsed.sub,
-          notificationType: parsed.notificationType,
-          channel: parsed.channel,
+      : {
+          userId: verified.userId,
+          notificationType: verified.notificationType,
+          channel: verified.channel,
         };
-      } catch (err) {
-        if (err instanceof ExtraRouteRejection) throw err;
+
+  const dispatched = await deps.dispatchSystemWrite({
+    handlerQn:
+      verified.kind === "address"
+        ? DeliveryHandlers.unsubscribeAddress
+        : DeliveryHandlers.unsubscribeUser,
+    tenantId: verified.tenantId,
+    payload,
+  });
+  return dispatched.isSuccess;
+}
+
+function confirmationPage(token: string): string {
+  return `<!doctype html>
+<html>
+<head>
+<meta charset="utf-8">
+<meta name="robots" content="noindex">
+<title>Unsubscribe</title>
+</head>
+<body>
+<p>Unsubscribe from these emails?</p>
+<form method="post" action="${DELIVERY_UNSUBSCRIBE_PATH}">
+<input type="hidden" name="token" value="${escapeHtmlAttr(token)}">
+<button type="submit">Unsubscribe</button>
+</form>
+</body>
+</html>`;
+}
+
+// One-click clients put the token in the query string; only the
+// confirmation-page form submits it in the body.
+function tokenFromPostRequest(request: SignatureExtraRouteVerifyRequest): string | undefined {
+  const contentType = request.headers["content-type"];
+  if (contentType?.includes("application/x-www-form-urlencoded")) {
+    const fromBody = new URLSearchParams(request.rawBody).get("token");
+    if (fromBody) return fromBody;
+  }
+  return request.query["token"];
+}
+
+// GET renders a confirmation page without writing; POST performs the opt-out.
+export function createUnsubscribeRoutes(
+  options: UnsubscribeRouteOptions,
+): readonly ExtraRouteDefinition[] {
+  assertUnsubscribeSecret(options.secret, "createUnsubscribeRoutes");
+  const encodedSecret = new TextEncoder().encode(options.secret);
+
+  const confirmRoute = signatureRoute<{ token: string }>({
+    method: "GET",
+    path: DELIVERY_UNSUBSCRIBE_PATH,
+    entry: "signature",
+    verify: async ({ query }) => {
+      const token = query["token"];
+      if (!token) {
         throw new ExtraRouteRejection(
           400,
           UNSUBSCRIBE_TOKEN_INVALID_BODY,
-          "unsubscribe token verification failed",
+          "missing unsubscribe token",
         );
       }
+      await verifyUnsubscribeToken(token, encodedSecret);
+      return { token };
     },
-    handler: async (c, verified, deps) => {
-      const payload =
-        verified.kind === "address"
-          ? {
-              addressHash: verified.addressHash,
-              notificationType: verified.notificationType,
-              channel: verified.channel,
-            }
-          : {
-              userId: verified.userId,
-              notificationType: verified.notificationType,
-              channel: verified.channel,
-            };
+    handler: async (c, { token }) =>
+      c.html(confirmationPage(token), 200, CONFIRMATION_PAGE_HEADERS),
+  });
 
+  const writeRoute = signatureRoute<VerifiedUnsubscribe>({
+    method: "POST",
+    path: DELIVERY_UNSUBSCRIBE_PATH,
+    entry: "signature",
+    verify: async (request) => verifyUnsubscribeToken(tokenFromPostRequest(request), encodedSecret),
+    handler: async (c, verified, deps) => {
       // Token-verify passed — everything below is a legitimate write. Don't
       // swallow write-errors as "invalid token", that would mask real bugs
       // (e.g. events-table missing, DB down) behind a misleading 400.
-      const dispatched = await deps.dispatchSystemWrite({
-        handlerQn:
-          verified.kind === "address"
-            ? DeliveryHandlers.unsubscribeAddress
-            : DeliveryHandlers.unsubscribeUser,
-        tenantId: verified.tenantId,
-        payload,
-      });
-      if (!dispatched.isSuccess) {
-        return c.text("Unsubscribe failed", 500);
+      const succeeded = await dispatchUnsubscribeWrite(verified, deps);
+      if (!succeeded) {
+        return c.html("Unsubscribe failed", 500, { "Cache-Control": "no-store" });
       }
-      return c.text("You have been unsubscribed.", 200);
+      return c.html("You have been unsubscribed.", 200, { "Cache-Control": "no-store" });
     },
   });
+
+  return [confirmRoute, writeRoute];
 }

package/src/file-derivatives/feature.ts

@@ -102,7 +102,7 @@ export function createFileDerivativesFeature(opts: FileDerivativesOptions = {}):
 
   return defineFeature(FEATURE_NAME, (r) => {
     r.describe(
-      "Declares the `derivativeRenderer` extension point. `ctx.derivatives.variant(fileRefId, spec, name)` derives a variant of a tracked FileRef the first time it's requested and reuses the stored result afterwards (derive-on-first-use, keyed by a hash of the spec). Mount at least one `derivatives-*` renderer feature alongside this one — without a registered renderer for the FileRef's MIME type, every `variant(...)` call throws. Also declares the `derivativePublicPredicate` extension point (`r.useExtension(EXT_DERIVATIVE_PUBLIC_PREDICATE, '<entityType>', { isPublic })`) and, when `createFileDerivativesFeature({resolveApexTenant})` is passed a host-resolver, mounts an anonymous `GET {basePath}/:fileRefId/:variant` route that serves any variant name the FileRef's field declared in its `variants` for a FileRef whose entityType has a registered predicate returning true — default-deny (404) otherwise, same as an unknown FileRef or an undeclared variant name. The route's only rate-limit (`per: \"ip\"`) trusts the first `x-forwarded-for` hop — deployers must ensure their ingress overwrites rather than appends to that header, or the throttle is bypassable by rotating it. `publicTenantResolution: \"fileRef\"` keeps resolveApexTenant as the host gate but reads the variant from the FileRef row's own tenant instead of the host's, so one shared platform host serves every tenant's public variants — each FileRef-tenant's own `isPublic` predicate still default-denies. Also declares the `derivativeOverlayResolver` extension point (`r.useExtension(EXT_DERIVATIVE_OVERLAY_RESOLVER, '<entityType>', { resolve })`), used to turn a variant's `overlays[].dataToken` into the actual QR payload for that FileRef's entityType before the variant is rendered — a variant declaring a `qr` overlay throws at request-time if no resolver is registered for the FileRef's entityType.",
+      "Declares the `derivativeRenderer` extension point. `ctx.derivatives.variant(fileRefId, spec, name)` derives a variant of a tracked FileRef the first time it's requested and reuses the stored result afterwards (derive-on-first-use, keyed by a hash of the spec). Mount at least one `derivatives-*` renderer feature alongside this one — without a registered renderer for the FileRef's MIME type, every `variant(...)` call throws. Also declares the `derivativePublicPredicate` extension point (`r.useExtension(EXT_DERIVATIVE_PUBLIC_PREDICATE, '<entityType>', { isPublic })`) and, when `createFileDerivativesFeature({resolveApexTenant})` is passed a host-resolver, mounts an anonymous `GET {basePath}/:fileRefId/:variant` route that serves any variant name the FileRef's field declared in its `variants` for a FileRef whose entityType has a registered predicate returning true — default-deny (404) otherwise, same as an unknown FileRef or an undeclared variant name. The route's only rate-limit (`per: \"ip\"`) depends on the server's `trustedProxyHops` matching the deployment's actual reverse-proxy count — at the default 0 it ignores `x-forwarded-for` entirely, so every caller shares one bucket until that's configured. `publicTenantResolution: \"fileRef\"` keeps resolveApexTenant as the host gate but reads the variant from the FileRef row's own tenant instead of the host's, so one shared platform host serves every tenant's public variants — each FileRef-tenant's own `isPublic` predicate still default-denies. Also declares the `derivativeOverlayResolver` extension point (`r.useExtension(EXT_DERIVATIVE_OVERLAY_RESOLVER, '<entityType>', { resolve })`), used to turn a variant's `overlays[].dataToken` into the actual QR payload for that FileRef's entityType before the variant is rendered — a variant declaring a `qr` overlay throws at request-time if no resolver is registered for the FileRef's entityType.",
     );
     r.uiHints({
       displayLabel: "File Derivatives",

package/src/file-derivatives/handlers/public-variant.query.ts

@@ -92,13 +92,11 @@ export const publicVariantQuery = defineQueryHandler({
   schema: publicVariantPayloadSchema,
   access: { roles: ["anonymous", "User", "TenantAdmin", "SystemAdmin"] },
   agent: { expose: false },
-  // ponytail: "ip" trusts the first x-forwarded-for hop (buildRequestContextData
-  // in request-id-middleware.ts) — this is the ONLY throttle on an anonymous,
-  // internet-facing render/storage-cost route, so it assumes the deployment's
-  // ingress overwrites (not appends to) x-forwarded-for. A direct-to-origin
-  // deployment lets a caller rotate the header per request and bypass this.
-  // Upgrade path if that assumption doesn't hold: trusted-proxy-count config
-  // on buildRequestContextData, same fix point as every other /api/* route.
+  // ponytail: "ip" is the ONLY throttle on an anonymous, internet-facing
+  // render/storage-cost route — its accuracy depends on the server's
+  // `trustedProxyHops` matching the real number of reverse proxies in
+  // front of it (see api/client-ip.ts). Left at the default 0 with a proxy
+  // actually in front, every caller collapses into one shared bucket.
   rateLimit: { per: "ip", limit: 60, windowSeconds: 60 },
   handler: async (query, ctx) => {
     const row = await fetchOne<FileRefRow>(ctx.db, fileRefsTable, {

package/src/foundation-shared/__tests__/mail-host-policy.test.ts

@@ -0,0 +1,68 @@
+import { describe, expect, test } from "bun:test";
+import type { lookup } from "node:dns/promises";
+import {
+  BlockedHostError,
+  HostResolutionError,
+  resolveMailConnectTarget,
+} from "../mail-host-policy";
+
+describe("resolveMailConnectTarget", () => {
+  test("pins a public hostname to its resolved address and sets servername to the original host", async () => {
+    const fakeLookup = (async () => [
+      { address: "203.0.113.5", family: 4 },
+    ]) as unknown as typeof lookup;
+
+    await expect(
+      resolveMailConnectTarget("smtp.tenant.example", { lookupFn: fakeLookup }),
+    ).resolves.toEqual({ host: "203.0.113.5", servername: "smtp.tenant.example" });
+  });
+
+  test("connects a public IP-literal host directly, without a servername", async () => {
+    await expect(resolveMailConnectTarget("93.184.216.34")).resolves.toEqual({
+      host: "93.184.216.34",
+    });
+  });
+
+  test("rejects a private IP-literal host", async () => {
+    await expect(resolveMailConnectTarget("10.0.0.5")).rejects.toThrow(BlockedHostError);
+  });
+
+  test("rejects a hostname that resolves to a private address", async () => {
+    const fakeLookup = (async () => [
+      { address: "127.0.0.1", family: 4 },
+    ]) as unknown as typeof lookup;
+
+    await expect(
+      resolveMailConnectTarget("internal.example", { lookupFn: fakeLookup }),
+    ).rejects.toThrow(BlockedHostError);
+  });
+
+  test("surfaces a DNS failure distinctly from a blocked host", async () => {
+    const failingLookup = (async () => {
+      throw new Error("ENOTFOUND");
+    }) as unknown as typeof lookup;
+
+    await expect(
+      resolveMailConnectTarget("nowhere.example", { lookupFn: failingLookup }),
+    ).rejects.toThrow(HostResolutionError);
+  });
+
+  test("allowlisted private host bypasses resolution entirely, case-insensitively", async () => {
+    const lookupFn = (() => {
+      throw new Error("must not be called for an allowlisted host");
+    }) as unknown as typeof lookup;
+
+    await expect(
+      resolveMailConnectTarget("Mailpit.internal", {
+        allowedPrivateMailHosts: ["mailpit.internal"],
+        lookupFn,
+      }),
+    ).resolves.toEqual({ host: "Mailpit.internal" });
+  });
+
+  test("a host absent from the allowlist still goes through resolution", async () => {
+    await expect(
+      resolveMailConnectTarget("10.0.0.5", { allowedPrivateMailHosts: ["mailpit.internal"] }),
+    ).rejects.toThrow(BlockedHostError);
+  });
+});

package/src/foundation-shared/index.ts

@@ -2,3 +2,12 @@
 // Foundation packages (ai-foundation, mail-foundation, file-foundation).
 
 export { requireDefined, requireNonEmpty, requireSecretSet } from "./config-helpers";
+export {
+  BlockedHostError,
+  HostResolutionError,
+  MAIL_ALLOWED_PRIVATE_HOSTS_ENV_VAR,
+  type MailConnectTarget,
+  type MailHostGuardOptions,
+  readAllowedPrivateMailHostsFromEnv,
+  resolveMailConnectTarget,
+} from "./mail-host-policy";

package/src/foundation-shared/mail-host-policy.ts

@@ -0,0 +1,70 @@
+// Connect-time egress guard for tenant-supplied SMTP/IMAP hosts (shared by
+// mail-transport-smtp and inbound-provider-imap): a tenant-controlled host
+// must resolve to a public address, never an internal one. Resolution
+// happens exactly once and the caller connects to the resolved address
+// directly (see kumiko-http's resolvePublicHostname for why that matters),
+// so this also covers hosts that were valid when a tenant set them and
+// only later re-resolve to a private address.
+//
+// `allowedPrivateMailHosts` is the operator's own escape hatch for an
+// internal relay or a dev/test server (mailpit, greenmail) — deliberately
+// an operator env var (KUMIKO_MAIL_ALLOWED_PRIVATE_HOSTS, read via
+// readAllowedPrivateMailHostsFromEnv), never a tenant-config key, so a
+// tenant can never grant themselves the bypass. Shared by both features
+// since a deploy commonly mounts both; declared once in mail-transport-
+// smtp's envSchema (see its feature.ts) to avoid the framework's env-var-
+// conflict check tripping when both features are mounted together.
+
+import type { lookup } from "node:dns/promises";
+import { isIP } from "node:net";
+import { resolvePublicHostname } from "@cosmicdrift/kumiko-framework/http";
+
+export const MAIL_ALLOWED_PRIVATE_HOSTS_ENV_VAR = "KUMIKO_MAIL_ALLOWED_PRIVATE_HOSTS";
+
+/** Parses the comma-separated operator allowlist env var. Never throws —
+ *  an unset or empty value just means no bypass. */
+export function readAllowedPrivateMailHostsFromEnv(
+  env: Readonly<Record<string, string | undefined>> = process.env,
+): readonly string[] {
+  const raw = env[MAIL_ALLOWED_PRIVATE_HOSTS_ENV_VAR];
+  if (!raw) return [];
+  return raw
+    .split(",")
+    .map((host) => host.trim())
+    .filter((host) => host.length > 0);
+}
+
+export type MailHostGuardOptions = {
+  readonly allowedPrivateMailHosts?: readonly string[];
+  readonly lookupFn?: typeof lookup;
+};
+
+export type MailConnectTarget = {
+  readonly host: string;
+  readonly servername?: string;
+};
+
+function isAllowedPrivateMailHost(host: string, allowed: readonly string[]): boolean {
+  return allowed.some((candidate) => candidate.toLowerCase() === host.toLowerCase());
+}
+
+export async function resolveMailConnectTarget(
+  host: string,
+  options: MailHostGuardOptions = {},
+): Promise<MailConnectTarget> {
+  if (isAllowedPrivateMailHost(host, options.allowedPrivateMailHosts ?? [])) {
+    return { host };
+  }
+  const resolved = await resolvePublicHostname(host, options.lookupFn);
+  // An IP-literal host pins to itself — no hostname was ever there for TLS
+  // SNI/cert validation to check, so `servername` stays unset (the mail
+  // libraries themselves skip SNI for an IP host).
+  if (isIP(host) !== 0) {
+    return { host: resolved.address };
+  }
+  return { host: resolved.address, servername: host };
+}
+
+// Re-exported so callers can classify a rejection (policy verdict, no
+// retry) without importing kumiko-http directly.
+export { BlockedHostError, HostResolutionError } from "@cosmicdrift/kumiko-framework/http";

package/src/inbound-provider-imap/__tests__/imap-foundation.integration.test.ts

@@ -40,6 +40,7 @@ import {
   tenantComplianceProfileEntity,
 } from "../../compliance-profiles";
 import { createConfigFeature } from "../../config";
+import { MAIL_ALLOWED_PRIVATE_HOSTS_ENV_VAR } from "../../foundation-shared";
 import {
   createInboundMailSupervisor,
   InboundMailAccountStatuses,
@@ -63,6 +64,11 @@ const USER = "testuser";
 const PASSWORD = "testpass";
 const ADDRESS = "testuser@example.com";
 
+// greenmail is a local test server, not tenant-supplied — needs the
+// operator escape hatch since HOST is a private/loopback address.
+const originalAllowedPrivateHostsEnv = process.env[MAIL_ALLOWED_PRIVATE_HOSTS_ENV_VAR];
+process.env[MAIL_ALLOWED_PRIVATE_HOSTS_ENV_VAR] = HOST;
+
 function probe(host: string, port: number): Promise<boolean> {
   return new Promise((resolve) => {
     const socket = connect({ host, port, timeout: 1500 });
@@ -127,6 +133,11 @@ beforeAll(async () => {
 });
 
 afterAll(async () => {
+  if (originalAllowedPrivateHostsEnv === undefined) {
+    delete process.env[MAIL_ALLOWED_PRIVATE_HOSTS_ENV_VAR];
+  } else {
+    process.env[MAIL_ALLOWED_PRIVATE_HOSTS_ENV_VAR] = originalAllowedPrivateHostsEnv;
+  }
   if (!available) return;
   await stack.cleanup();
   resetPiiSubjectKmsForTests();

package/src/inbound-provider-imap/__tests__/imap-live.integration.test.ts

@@ -15,10 +15,11 @@
 // — der volle Dispatcher-Pfad ist in
 // inbound-mail-foundation.integration.test.ts abgedeckt.
 
-import { describe, expect, test } from "bun:test";
+import { afterAll, describe, expect, test } from "bun:test";
 import { connect } from "node:net";
 import { createSecret } from "@cosmicdrift/kumiko-framework/secrets";
 import { createTransport } from "nodemailer";
+import { MAIL_ALLOWED_PRIVATE_HOSTS_ENV_VAR } from "../../foundation-shared";
 import {
   type InboundMailContext,
   isInboundAuthError,
@@ -35,6 +36,18 @@ const USER = "testuser";
 const PASSWORD = "testpass";
 const ADDRESS = "testuser@example.com";
 
+// greenmail is a local test server, not tenant-supplied — needs the
+// operator escape hatch since HOST is a private/loopback address.
+const originalAllowedPrivateHostsEnv = process.env[MAIL_ALLOWED_PRIVATE_HOSTS_ENV_VAR];
+process.env[MAIL_ALLOWED_PRIVATE_HOSTS_ENV_VAR] = HOST;
+afterAll(() => {
+  if (originalAllowedPrivateHostsEnv === undefined) {
+    delete process.env[MAIL_ALLOWED_PRIVATE_HOSTS_ENV_VAR];
+  } else {
+    process.env[MAIL_ALLOWED_PRIVATE_HOSTS_ENV_VAR] = originalAllowedPrivateHostsEnv;
+  }
+});
+
 function probe(host: string, port: number): Promise<boolean> {
   return new Promise((resolve) => {
     const socket = connect({ host, port, timeout: 1500 });